Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
keygen.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
keygen.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
photo2video.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
photo2video.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
安装说明.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
安装说明.url
Resource
win10v2004-20231215-en
General
-
Target
photo2video.exe
-
Size
2.3MB
-
MD5
a6a6986e310551c8365767ab62dc58a6
-
SHA1
6cc1de7dfd823f86ca216706f2d822f3eaaf0273
-
SHA256
cd93eb0e3a146b6f14252fe542dda1e8f4fda74dcc819f398bb3217c4fdd4a0b
-
SHA512
39a1e27bedd738625be56e2b8b7cb197d7dac0e5181883f4478dd6005393bbb623e2b8957719c79f6966de7926d3aab84a17c708a503192808f518e581da1c34
-
SSDEEP
49152:0oSC0gUW0x327TbfiVgasjuaXNg9yUX7iuSp7fVT/IXe1wsauLUXqIOrGRy:0oL827KVhsaSs7iL5CeQ+UXq5rG0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2776 INS497E.tmp -
Loads dropped DLL 3 IoCs
pid Process 1604 photo2video.exe 2776 INS497E.tmp 2776 INS497E.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2776 INS497E.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1604 wrote to memory of 2776 1604 photo2video.exe 28 PID 1604 wrote to memory of 2776 1604 photo2video.exe 28 PID 1604 wrote to memory of 2776 1604 photo2video.exe 28 PID 1604 wrote to memory of 2776 1604 photo2video.exe 28 PID 1604 wrote to memory of 2776 1604 photo2video.exe 28 PID 1604 wrote to memory of 2776 1604 photo2video.exe 28 PID 1604 wrote to memory of 2776 1604 photo2video.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\photo2video.exe"C:\Users\Admin\AppData\Local\Temp\photo2video.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\INS497E.tmpC:\Users\Admin\AppData\Local\Temp\INS497E.tmp /SL3 $80124 C:\Users\Admin\AppData\Local\Temp\photo2video.exe 2366865 2370225 614402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD599fa571a302c7e8ed49d149c1c700623
SHA155f36c6868d698cf9f4b84296b51737b34d014d0
SHA256d2e9c5966937beadba64d89d3ce31212c61a85118d9662adb98fdeac1ad6eb44
SHA512f14a45f0cf8b338efa4371ca88767189cce8ef919aa7c691ba7105a393acaf07b43721f2a74417075aa99acea875cc5de4c7a09fd38dad6f913b9a675c0ddec0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3